Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
757
questions
1
vote
1
answer
3k
views
FreeIPA : new/existing accounts expired when ssh'ing into replica
I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
- 11
2
votes
0
answers
479
views
User Resource management: cgroups + systemd + ssh
I am trying to limit the memory of a single user that keeps crashing our OpenSuse Server.
What I have done is as desribed here, to modify the limit of the user's slice via
systemctl set-property ...
- 121
1
vote
1
answer
1k
views
Ubuntu 18.04 server - how to change or adjust operating system logging for a certain systemd service?
I've tried quite a bit of Googling on this but have not come up with much so I figured I'd ask here. Here's my current problem:
I'm running Ubuntu 18.04 server pretty much stock. The purpose of the ...
- 175
4
votes
1
answer
3k
views
PAM with pam_krb5 to authenticate nginx requests
I am aware of the gazzilion pam / nginx questions here and on "Unix/Linux" but they are either unanswered or not related to my setup - so i try again :)
TL;dr
While the setup works perfectly with an ...
- 337
2
votes
1
answer
4k
views
SELinux: pam_systemd(sudo:session): Failed to connect to system bus: Permission denied
On one of CentOS 7 servers I cannot perform sudo from nrpe user (Nagios daemon remote monitoring).
Error message:
Dec 31 08:28:10 ip-172-31-36-176 sudo: pam_unix(sudo:session): session opened for ...
0
votes
0
answers
434
views
TightVNC Server sometimes fail to start on RHEL7.4
I've a RHEL 7.4 box with TightVNC service enabled on boot and sometimes the service fails to start with a PAM permission denied error:
systemd[2027]: pam_nologin(login:account): conversation failed
...
- 5,620
1
vote
0
answers
110
views
pam_access using netgroup for host origin
I would like to be able to use:
+ : @user_netgroup : @host_netgroup
in my access.conf, but this seems to fail due to pam_access not supporting host netgroups. If I substitute an IP or fully ...
- 326
0
votes
1
answer
432
views
sshd: Disable PAM authentication for period of time after successful login
We're using public key authentication in combination with the Yubico pam for our servers.
Is it possible to temporarily (e.g. 1 minute) skip the Yubico pam for subsequent authentications when a user ...
- 155
2
votes
1
answer
397
views
AWS Amazon AMI - Restrict SFTP/SSH access
I have an AWS Amazon Linux EC2 instance running with sftp/ftp server (vsftp).
For security purposes I want to protect the system with the best practise solution for AWS instances.
My goal is to ...
- 21
3
votes
3
answers
2k
views
how to require publickey and otp, or password and otp when logging in with ssh?
I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation.
...
- 131
1
vote
1
answer
2k
views
pam_tally2 incrememts before password for su attempts
There is a similar behavior here but I believe this is a different underlying cause, or at least requires a different solution since this failure isn't due to SSH keys.
Our company is undergoing a ...
- 11
1
vote
0
answers
92
views
What pam.d file does HP iLO Text Console use?
We are in an environment where kerberos authentication is being enforced by our security team. We are deploying RHEL 7.4.
In the event of authentication servers being unreachable (preventing ssh ...
- 2,747
-4
votes
1
answer
197
views
Implementing Kerberos Authentication on Linux servers using script [closed]
My client wants to implement Kerberos Authentication on multiple Oracle Linux Boxes. Do they need to be done manually or can I implement on all of them using any script? Is there any way to script ...
- 115
0
votes
1
answer
447
views
PAM deny rule not applied on Ubuntu in Google Cloud
I added
auth requisite pam_deny.so
as the first line of every file in /etc/pam.d/ (including sshd), but SSH connections still succeed without a problem. This is on a default Google Cloud Ubuntu ...
google-cloud-platform
2
votes
1
answer
12k
views
FTP PAM Setup for VSFTPD
OK. I know this is one of the most asked questions here. But most answers are either telling me to add nologin to allowed shells (nope... not doing that) or disabling SELinux (which i don't have - ...
- 163
6
votes
1
answer
3k
views
OpenVPN 2.4 + Google Authenticator = authentication failure
We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook.
I'm planning to upgrade to Ubuntu 18.04 ...
- 473
2
votes
3
answers
6k
views
pam_mount home directories over cifs, sssd and Bionic Beaver
I've configured a Ubuntu Bionic Beaver client to authenticate against a Samba ADS (Zentyal), using sssd. This guide was more or less all it took to get there. EDIT: see my answer to get a quote of the ...
- 250
2
votes
1
answer
225
views
Access of users using google-authenicator without token
I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
2
votes
1
answer
2k
views
Cannot login with account on RHEL 7.5 server with DISA STIG Profile enabled
This has happened several times now, and I am getting frustrated.
I don't know how it happens, but sometimes a user account gets locked out. I change their passwd, either through passwd or chpasswd. ...
- 171
0
votes
0
answers
2k
views
What is wrong with this pam_ldap configuration?
I've set up LDAP auth for PAM on an Ubuntu 16.04 machine. I can't log in over SSH even though I know the password is correct. My goal is to have a list of local users, and anyone having an account on ...
- 164
2
votes
1
answer
885
views
pam_winbind: unknown option require_membership_of
I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group.
I'm using a generic conf file for the vsftpd, with ...
18
votes
1
answer
89k
views
Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine
Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines.
When I try to SSH using "ssh user@domainname@hostname" it asks ...
- 299
2
votes
1
answer
4k
views
Managing /etc/security/access.conf with ansible
New to Ansible and have several machines which make use of the pam_access module which is configured in /etc/security/access.conf. Multiple lines specifying ALLOW/DENY (+/-) and then either users or ...
- 3,784
0
votes
1
answer
5k
views
Authenticated with SSSD (LDAP) but use /etc/passwd after login
I have the following setting:
I have users in two different domains from two different organizations (separated AD installations) with users user@DOMAIN and user@OTHERDOMAIN
On the system, these ...
- 111
4
votes
3
answers
5k
views
Modifying pam with Ansible
As part of a new server setup, I provision /etc/security/access.conf with user/group and src IP addresses of allowed ssh logins. This requires enabling pam_access in the /etc/pam.d/login and /etc/pam....
- 3,784
1
vote
1
answer
1k
views
Linux Cluster with LDAP, automatically and simultaneously creating homedir on multiple machines
I'm setting up a computer cluster of (20+) machines, I have a working central ldap server for authenticating users and keeping GID and UID synced across the cluster.
One machine acts as a head node, ...
- 21
1
vote
0
answers
196
views
Sync users on Debian with Active Directory
I would like to be able to dynamically manage accounts on a Debian box that I am building. For this I think a possible solution is to have the box on our Windows domain and sync with a user group on ...
- 183
2
votes
1
answer
1k
views
Vsftpd/pam_userdb.so - auto-create virtual user home directories
Setup:
Amazon Linux EC2
vsftpd
PAM authentication with pam_userdb.so
Usernames/passwords written to Berkeley user db from an external source (lsyncd).
There are many 1000s of virtual users, to date ...
- 121
0
votes
0
answers
372
views
Configuring PAM to access a Kerberized cluster
I have the following situation: I have a server running RHEL 7.4. This server's main purpose is to host an RStudio Server Pro instance, which allows users to connect to a kerberized Hadoop cluster in ...
- 113
1
vote
1
answer
1k
views
Cannot connect to Centos 7 server (PAM)
After attempting to install a PAM module (my first), i've been having this issue. I ended up removing it because the module was broken which resulted in users not being able to access the system. Now ...
0
votes
0
answers
2k
views
Login/permissions problems after installing Kerberos client
Login/permissions problems after installing Kerberos client
After setting up a kerberos server (on a separate machine) and installing kerberos client on Ubuntu 16.04 desktop (and laptop), I have ...
- 111
1
vote
0
answers
1k
views
Roundcube IMAP log -- NO [AUTHENTICATIONFAILED] Authentication failed
system: Ubuntu 17.10
This is the error I am getting when trying to log in log-file
/var/lib/roundcube/logs/imap:
[17-Apr-2018 22:03:13 -0700]: <3aedeusd> [1116] S: * OK [CAPABILITY IMAP4rev1 ...
- 274
0
votes
1
answer
2k
views
Why am I not seeing the user lockout message?
When I try to login 3 times with the wrong password (locally), instead of seeing user locked out message:
su - myuser
Account locked due to 3 failed logins
I see this:
[myuser@ip-10-10-2-53 ~]$ su -...
- 174
2
votes
2
answers
4k
views
How to use PAM to manage lockout policy for ssh public key authentication methods
I have followed instructions on redhat on how to harden authentication on a linux server, but we only use SSH with public key auth. According to these instructions:
https://access.redhat.com/...
- 174
1
vote
0
answers
191
views
Ignore pam_authz_search for a specific service
It is possible to use pam_authz_search option in libpam-ldapd nslcd config file to filter authentication attempts based on a custom pattern.
Is it possible to make specific service to be exempt from ...
- 229
0
votes
0
answers
360
views
OpenLDAP 2.4.44 Authentication on CentOS/RHEL 7
I have OpenLDAP 2.4.44 running on CentOS 7.4 with a "tester" user added. I can query the user and change the password, but when authenticating with the GNOME login screen is always rejected. I used ...
- 101
0
votes
0
answers
391
views
Authenticate and mount home using ssh and nfs
How would I go about trying to authenticate a user against a particular system and then mounting his tree using NFS.
The user would have his own desktop and when the user goes to work on a separate ...
- 101
1
vote
0
answers
148
views
Access to http restricted area using private key
In my Apache configuration (Ubuntu Server), i have the following settings:
AddExternalAuth pwauth /usr/sbin/pwauth
SetExternalAuthMethod pwauth pipe
<Directory /secure>
...
- 111
0
votes
0
answers
320
views
missing reverse resolution in ssh connection
i'm having an issue during the connection via ssh from a windows server to a linux server RH4 using ssh-key pair authentication because the reverse resolution doesn't run here although it runs using ...
- 121
0
votes
1
answer
46
views
Linux authentication issues
I've set up both an AWS image and a Kubuntu image, both with the CIS benchmarking principles outlined on https://www.cisecurity.org/cis-benchmarks/ having been applied.
Sporadically during this time ...
- 119
3
votes
1
answer
2k
views
Allow user to sudo as any user in group
I'm running a service where I have users that are running services from their home directories. They are all in the group serviceusers, and I have a user that will perform automated tasks initiated ...
- 131
0
votes
1
answer
52
views
Can PAM be used to authenticate non-OS users?
I have a webapp (JupyterHub served from Ubuntu 16.04 LTS). I'd like to have users authenticate to it with a username/password pair. These users will not typically have local OS user accounts. Is it ...
- 113
0
votes
1
answer
2k
views
Postfix SMTP SASL Authentication with pam_mysql can't accept email addresses as username
I'm currently trying working on a project to update an existing postfix deployment. I'm having issues with authenticating users against smtp.
The primary issue I have is that our postfix users ...
- 219
10
votes
1
answer
6k
views
PAM accepting any password for valid users
I just linked my Arch Linux workstation to the Samba AD I set up for our company. I tested it, and it worked, or so I thought. It accepted my password, created my homedir and everything, and logged me ...
- 558
1
vote
1
answer
477
views
checkpassword-pam works locally, but not through qmail
I have checkpassword-pam 0.99, and when I run it locally, as in
echo -e 'testuser\0theuserspassword\0.' |
/usr/local/bin/checkpassword-pam -s smtp --debug --stdout /usr/bin/id 3<&0
...
- 371
5
votes
1
answer
1k
views
Why can't I use pam_echo.so in the sudo pam stack?
I have a CentOS 7 machine where I'd like to display a message when authentication fails during sudo. I tried to do this by adding a pam_echo line in /etc/pam.d/sudo.
For testing, I created a file, /...
- 371
3
votes
2
answers
2k
views
SSSD LDAP authentication using two different LDAP servers
I am trying to setup LDAP authentication using SSSD on CentOS 7.
Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for authentification (basically ...
- 33
0
votes
1
answer
2k
views
LDAP completely ignores pam_groupdn and pam_filter attribute in ldap.conf
OS: Ubuntu 17.10
I currently installed ldap on an Ubuntu to access a ldap server. I configured nls, pam and ldap like in many tutorials proposed. So it worked but now any ldap user can login to the ...
- 19
1
vote
1
answer
2k
views
unable to login after making changes to system-auth and password-auth
so I am trying to accomplish something and I can't quite get it. I am trying to limit login attempts to 3 (via ssh, terminal or gui. After those 3 failed attempts, I want to lock the account for 1 ...
- 181
1
vote
1
answer
31
views
Does a ssh server plugin allowing interactivity exist?
I'm wondering if there is a way to get a ssh server to allow interaction with the user such as Request for access?
I've found out some pam plugin allowing for 2FA but for now I can't found anything ...
- 975